FCA Opens Crypto Authorisation Gateway: What UK Firms Must Submit by 28 February

UK cryptoasset firms have a five-month window opening this month to secure the authorisation they'll need to keep operating legally. The Financial Conduct Authority's application gateway opens at 9am on 30 September 2026 and closes at 11:59pm on 28 February 2027, under a direction the regulator confirmed as part of its final rules package published in June.

The full regulatory regime doesn't take effect until 25 October 2027. But the gateway timing matters well before then, because of how the transition is structured.

Firms carrying out regulated cryptoasset activities will need authorisation under the Financial Services and Markets Act, following the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, passed by Parliament in February 2026. The FCA completed its core rulebook for the new regime with Policy Statement PS26/9, published 30 June 2026.

One point the FCA has been explicit about, and worth stating plainly: existing registration does not carry over automatically. Firms currently registered under the Money Laundering Regulations — the anti-money-laundering framework most UK crypto businesses currently operate under — do not get waved through to full FSMA authorisation. A fresh application is required regardless of current registration status.

The distinction between the two frameworks is real, not just paperwork. MLR registration focuses narrowly on anti-money-laundering and counter-terrorist-financing controls. FSMA authorisation goes considerably further, covering a firm's governance, financial resources, systems and controls, and ongoing supervision.

The five regulated activity categories under the new regime cover: issuing qualifying stablecoins, operating a cryptoasset trading platform, dealing in or arranging cryptoasset transactions, providing custody or safeguarding services, and arranging staking services. Each carries its own specific FCA expectations — stablecoin issuers face particular scrutiny on reserve backing and redemption rights, trading platforms on market integrity under the new Market Abuse Regime for Cryptoassets, and custody providers on asset segregation and insolvency protection.

Timing within the window carries real consequences, not just administrative tidiness. Firms that submit a complete application between 30 September 2026 and 28 February 2027 benefit from what the legislation calls a saving provision. In practice, this means a firm can continue providing its cryptoasset services while the FCA works through its application, even if that review extends past the regime's full commencement date of 25 October 2027.

Firms that apply after the window closes don't get that same benefit. The FCA has indicated it won't expedite late applications, and a firm still unauthorised once the regime fully takes effect risks operating in breach of the general prohibition under FSMA — a criminal offence, not merely a compliance failing.

The FCA has also flagged that it expects genuine UK operational substance behind an application, not simply a UK-registered entity managed entirely from overseas. Firms structuring their UK presence primarily for licensing purposes, without meaningful UK-based governance and decision-making, should expect closer scrutiny during the assessment process.

For compliance teams, the practical task ahead of 30 September is less about the application form itself and more about the underlying assessment work: confirming which specific activities a firm's business model actually falls into under the new perimeter, checking that governance and financial resourcing genuinely meet FSMA's threshold conditions rather than the lighter MLR bar, and making sure the case for real UK substance is one the firm can actually demonstrate, not just assert. The FCA has been running a series of preparatory webinars through September specifically to help firms work through these requirements ahead of the window opening.